Skip to main content
AWS Messaging 1.1.0Last updated in version 1.1.0

Amazon MQ Module

View Source Release Notes

This module deploys an Amazon MQ broker supporting both ActiveMQ and RabbitMQ engine types.

Engine Types​

ActiveMQ​

  • Deployment modes: SINGLE_INSTANCE, ACTIVE_STANDBY_MULTI_AZ
  • Ports: 8162 (Web Console), 61617 (OpenWire+SSL), 5671 (AMQP+SSL), 8883 (MQTT+SSL), 61614 (STOMP+SSL), 61619 (WSS)
  • Supports EFS and EBS storage types, audit logging, and XML configuration

RabbitMQ​

  • Deployment modes: SINGLE_INSTANCE, CLUSTER_MULTI_AZ
  • Ports: 443 (Management UI), 5671 (AMQP+SSL)

Usage​

module "amazon_mq" {
  source = "git::git@github.com:gruntwork-io/terraform-aws-messaging.git//modules/amazon-mq?ref=v0.0.1"

  broker_name        = "my-broker"
  engine_type        = "ActiveMQ"
  engine_version     = "5.18"
  host_instance_type = "mq.m5.large"
  deployment_mode    = "SINGLE_INSTANCE"

  subnet_ids = ["subnet-abc123"]
  vpc_id     = "vpc-abc123"

  admin_username = "admin"
  admin_password = var.admin_password

  allowed_cidr_blocks = ["10.0.0.0/16"]
}

See variables.tf for all available options and the examples folder for working examples.

Sample Usage​

main.tf

# ------------------------------------------------------------------------------------------------------
# DEPLOY GRUNTWORK'S AMAZON-MQ MODULE
#
# NOTE: This module uses some sensitive variables marked inline with "# SENSITIVE".
# When using values other than defaults for these variables, set them through environment variables or
# another secure method.
#
# ------------------------------------------------------------------------------------------------------

module "amazon_mq" {

  source = "git::git@github.com:gruntwork-io/terraform-aws-messaging.git//modules/amazon-mq?ref=v1.1.0"

  # ----------------------------------------------------------------------------------------------------
  # REQUIRED VARIABLES
  # ----------------------------------------------------------------------------------------------------

  # The password for the admin user.
  admin_password = <string> # SENSITIVE

  # The username for the admin user.
  admin_username = <string>

  # The name of the Amazon MQ broker.
  broker_name = <string>

  # The type of broker engine. Valid values are ActiveMQ and RabbitMQ.
  engine_type = <string>

  # The version of the broker engine. For ActiveMQ, e.g. '5.18'. For RabbitMQ,
  # e.g. '3.13'.
  engine_version = <string>

  # The broker's instance type. e.g. 'mq.m5.large', 'mq.t3.micro'.
  host_instance_type = <string>

  # List of subnet IDs for the broker. Use 1 subnet for SINGLE_INSTANCE, 2+ for
  # ACTIVE_STANDBY_MULTI_AZ or CLUSTER_MULTI_AZ.
  subnet_ids = <list(string)>

  # The ID of the VPC in which to create the broker security group.
  vpc_id = <string>

  # ----------------------------------------------------------------------------------------------------
  # OPTIONAL VARIABLES
  # ----------------------------------------------------------------------------------------------------

  # List of additional security group IDs to attach to the broker.
  additional_security_group_ids = []

  # List of CIDR blocks allowed to connect to the broker.
  allowed_cidr_blocks = []

  # List of CIDR blocks to allow outbound traffic from the broker security
  # group. Defaults to unrestricted.
  allowed_outbound_cidr_blocks = ["0.0.0.0/0"]

  # List of security group IDs allowed to connect to the broker.
  allowed_security_groups = []

  # Map of application users for the broker, keyed by username. Each user must
  # specify password, and optionally console_access and groups (ActiveMQ only).
  application_users = {}

  # Whether to apply changes to the broker immediately or during the next
  # maintenance window.
  apply_immediately = false

  # Whether to enable audit logging for the broker. Only supported for ActiveMQ
  # engine type.
  audit_log_enabled = false

  # Whether to automatically upgrade to new minor versions of the broker engine
  # as they are released.
  auto_minor_version_upgrade = false

  # The ActiveMQ XML configuration data. When set, an aws_mq_configuration
  # resource is created and associated with the broker. Only applicable for
  # ActiveMQ engine type.
  configuration_data = null

  # If you set this variable to false, this module will not create any
  # resources. This is used as a workaround because Terraform does not allow you
  # to use the 'count' parameter on modules.
  create_resources = true

  # Custom tags to apply to all resources created by this module.
  custom_tags = {}

  # Defines whether this broker is a part of a data replication pair. Valid
  # values are CRDR (Cross-Region Data Replication) and NONE.
  data_replication_mode = null

  # The deployment mode of the broker. Valid values are SINGLE_INSTANCE,
  # ACTIVE_STANDBY_MULTI_AZ, and CLUSTER_MULTI_AZ.
  deployment_mode = "SINGLE_INSTANCE"

  # Whether to explicitly configure the encryption_options block on the broker.
  # Amazon MQ always encrypts data at rest. When true (default), you can specify
  # a custom KMS key via kms_key_id. When false, the block is omitted and AWS
  # uses its default AWS-owned key.
  enable_encryption = true

  # Whether to enable general logging for the broker.
  general_log_enabled = false

  # The ARN of a custom KMS key to use for encryption at rest. If not set and
  # enable_encryption is true, the AWS-owned key is used.
  kms_key_id = null

  # The day of the week for the maintenance window. e.g. 'MONDAY', 'TUESDAY',
  # etc. Set all three maintenance variables to enable.
  maintenance_day_of_week = null

  # The time of day for the maintenance window in 24-hour format. e.g. '02:00'.
  maintenance_time_of_day = null

  # The time zone for the maintenance window. e.g. 'UTC', 'America/New_York'.
  maintenance_time_zone = "UTC"

  # Whether to enable connections from applications outside of the VPC that
  # hosts the broker's subnets.
  publicly_accessible = false

  # The name for the security group. Defaults to '<broker_name>-mq' if not set.
  security_group_name = null

  # Storage type of the broker. Valid values are 'efs' and 'ebs'. Only
  # configurable for ActiveMQ (defaults to 'efs'). RabbitMQ always uses EBS.
  storage_type = null

  # Whether to use the AWS-owned KMS key for encryption at rest. Set to false to
  # use a custom kms_key_id.
  use_aws_owned_key = true

}


Reference​

Required​

admin_passwordstringrequired

The password for the admin user.

admin_usernamestringrequired

The username for the admin user.

broker_namestringrequired

The name of the Amazon MQ broker.

engine_typestringrequired

The type of broker engine. Valid values are ActiveMQ and RabbitMQ.

engine_versionstringrequired

The version of the broker engine. For ActiveMQ, e.g. '5.18'. For RabbitMQ, e.g. '3.13'.

host_instance_typestringrequired

The broker's instance type. e.g. 'mq.m5.large', 'mq.t3.micro'.

subnet_idslist(string)required

List of subnet IDs for the broker. Use 1 subnet for SINGLE_INSTANCE, 2+ for ACTIVE_STANDBY_MULTI_AZ or CLUSTER_MULTI_AZ.

vpc_idstringrequired

The ID of the VPC in which to create the broker security group.

Optional​

additional_security_group_idslist(string)optional

List of additional security group IDs to attach to the broker.

[]
allowed_cidr_blockslist(string)optional

List of CIDR blocks allowed to connect to the broker.

[]
allowed_outbound_cidr_blockslist(string)optional

List of CIDR blocks to allow outbound traffic from the broker security group. Defaults to unrestricted.

[ "0.0.0.0/0" ]
allowed_security_groupslist(string)optional

List of security group IDs allowed to connect to the broker.

[]
application_usersmap(object(…))optional

Map of application users for the broker, keyed by username. Each user must specify password, and optionally console_access and groups (ActiveMQ only).

map(object({
    password       = string
    console_access = optional(bool, false)
    groups         = optional(list(string), [])
  }))
{}
apply_immediatelybooloptional

Whether to apply changes to the broker immediately or during the next maintenance window.

false
audit_log_enabledbooloptional

Whether to enable audit logging for the broker. Only supported for ActiveMQ engine type.

false

Whether to automatically upgrade to new minor versions of the broker engine as they are released.

false
configuration_datastringoptional

The ActiveMQ XML configuration data. When set, an aws_mq_configuration resource is created and associated with the broker. Only applicable for ActiveMQ engine type.

null
create_resourcesbooloptional

If you set this variable to false, this module will not create any resources. This is used as a workaround because Terraform does not allow you to use the 'count' parameter on modules.

true
custom_tagsmap(string)optional

Custom tags to apply to all resources created by this module.

{}
data_replication_modestringoptional

Defines whether this broker is a part of a data replication pair. Valid values are CRDR (Cross-Region Data Replication) and NONE.

null
deployment_modestringoptional

The deployment mode of the broker. Valid values are SINGLE_INSTANCE, ACTIVE_STANDBY_MULTI_AZ, and CLUSTER_MULTI_AZ.

"SINGLE_INSTANCE"
enable_encryptionbooloptional

Whether to explicitly configure the encryption_options block on the broker. Amazon MQ always encrypts data at rest. When true (default), you can specify a custom KMS key via kms_key_id. When false, the block is omitted and AWS uses its default AWS-owned key.

true

Whether to enable general logging for the broker.

false
kms_key_idstringoptional

The ARN of a custom KMS key to use for encryption at rest. If not set and enable_encryption is true, the AWS-owned key is used.

null

The day of the week for the maintenance window. e.g. 'MONDAY', 'TUESDAY', etc. Set all three maintenance variables to enable.

null

The time of day for the maintenance window in 24-hour format. e.g. '02:00'.

null
maintenance_time_zonestringoptional

The time zone for the maintenance window. e.g. 'UTC', 'America/New_York'.

"UTC"

Whether to enable connections from applications outside of the VPC that hosts the broker's subnets.

false
security_group_namestringoptional

The name for the security group. Defaults to '<broker_name>-mq' if not set.

null
storage_typestringoptional

Storage type of the broker. Valid values are 'efs' and 'ebs'. Only configurable for ActiveMQ (defaults to 'efs'). RabbitMQ always uses EBS.

null
use_aws_owned_keybooloptional

Whether to use the AWS-owned KMS key for encryption at rest. Set to false to use a custom kms_key_id.

true